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The  City  Services  Auditor  was  created  within  the  Controller's  Office  through  an  amendment  to  the 
City  Charter  that  was  approved  by  voters  in  November  2003.  Under  Appendix  F to  the  City  Charter, 
the  City  Services  Auditor  has  broad  authority  for: 

• Reporting  on  the  level  and  effectiveness  of  San  Francisco’s  public  services  and 
benchmarking  the  city  to  other  public  agencies  and  jurisdictions. 

• Conducting  financial  and  performance  audits  of  city  departments,  contractors,  and  functions 
to  assess  efficiency  and  effectiveness  of  processes  and  services. 

• Operating  a whistleblower  hotline  and  website  and  investigating  reports  of  waste,  fraud,  and 
abuse  of  city  resources. 

• Ensuring  the  financial  integrity  and  improving  the  overall  performance  and  efficiency  of  city 
government. 

The  audits  unit  conducts  financial  audits,  attestation  engagements,  and  performance  audits.  Financial 
audits  address  the  financial  integrity  of  both  city  departments  and  contractors  and  provide  reasonable 
assurance  about  whether  financial  statements  are  presented  fairly  in  all  material  aspects  in 
conformity  with  generally  accepted  accounting  principles.  Attestation  engagements  examine,  review, 
or  perform  procedures  on  a broad  range  of  subjects  such  as  internal  controls;  compliance  with 
requirements  of  specified  laws,  regulations,  rules,  contracts,  or  grants;  and  the  reliability  of 
performance  measures.  Performance  audits  focus  primarily  on  assessment  of  city  services  and 
processes,  providing  recommendations  to  improve  department  operations. 

We  conduct  our  audits  in  accordance  with  the  Government  Auditing  Standards  published  by  the  U.S. 
Government  Accountability  Office  (GAO).  These  standards  require: 

• Independence  of  audit  staff  and  the  audit  organization. 

• Objectivity  of  the  auditors  performing  the  work. 

• Competent  staff,  including  continuing  professional  education. 

• Quality  control  procedures  to  provide  reasonable  assurance  of  compliance  with  the  auditing 
standards. 
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May  20,  2010 

Chief  George  Gascon 
Thomas  J.  Cahill  Hall  of  Justice 
850  Bryant  Street  Room  525 
San  Francisco,  CA  94103-4603 

Dear  Chief  Gascon: 


Police  Commission 
Thomas  J.  Cahill  Hall  of  Justice 
850  Bryant  Street  Room  505 
San  Francisco,  CA  94103-4603 


The  Controller's  Office,  City  Services  Auditor,  presents  its  audit  report  regarding  the  San 

Francisco  Police  Department’s  (department)  Property  Control  Unit  (PCU).  The  audit  found  that: 

• The  PCU  can  account  for  all  monetary  evidence  in  its  inventory  and  there  is  no  indication  of 
any  misappropriation  of  monetary  evidence. 

• The  department  needs  to  clarify  and  expand  upon  its  authoritative  guidance  (Department 
General  Orders  and  Bulletins)  that  govern  the  packaging  and  sealing  of  monetary  evidence 
envelopes. 

• The  department’s  Property  Evidence  Tracking  System  (PETS)  does  not  contain  an  accurate 
record  of  the  total  dollar  value  of  monetary  evidence  held  at  the  PCU  because  the  system 
does  not  allow  the  dollar  amount  field  to  be  edited,  which  prevents  PCU  staff  from  correcting 
known  discrepancies. 

• PETS  is  an  antiquated  system  that  does  not  provide  system  security  that  is  consistent  with 
current  industry  standards. 

• Oversight  of  PCU  can  be  improved  by  adopting  better  segregation  of  money-handling  duties 
and  requiring  the  PCU  to  submit  routine  reports  to  department  management  regarding  the 
status  of  the  unit’s  inventory  of  monetary  evidence. 

• PETS  records  showed  that  monetary  evidence  envelopes  containing  a total  of  $252,354, 
had  exceeded  the  15-month  hold  and  destruction  cycle. 


This  report  includes  19  recommendations  for  the  San  Francisco  Police  Department.  The 
department’s  response  to  the  audit  is  attached  as  Appendix  A.  We  appreciate  the  assistance 
and  cooperation  that  PCU  and  other  department  staff  provided  to  us  during  the  audit. 

Respectfully  submitted, 


Tonia  Lediju 
Director  of  Audits 


415-554-7500 


City  Hall  • 1 Dr.  Carlton  B.  Goodlett  Place  • Room  316  • San  Francisco  CA  94102-4694 


FAX  415-554-7466 


cc:  Mayor 

Board  of  Supervisors 
Civil  Grand  Jury 
Budget  Analyst 
Public  Library 
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LIST  OF  ACRONYMS 


The  following  acronyms  are  used  throughout  the  audit  report: 

DT  Department  of  Technology 

PCU  Property  Control  Unit 

PETS  Property  Evidence  Tracking  System 

SFPD  San  Francisco  Police  Department  (department) 
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INTRODUCTION 


Audit  Authority 


Background 


The  Property  Control  Unit 
manages  evidence 
processing,  storage,  and 
disposal 


Published  department 
guidance  establishes 
evidence-handling  rules 


The  City  Charter  provides  the  Controller,  City  Services 
Auditor  (CSA),  with  broad  authority  to  conduct  audits.  This 
audit  was  conducted  under  that  authority  and  pursuant  to  a 
request  from  the  Office  of  the  Chief  of  Police  of  the  San 
Francisco  Police  Department. 

The  San  Francisco  Police  Department  (SFPD,  department) 
is  organized  broadly  into  four  offices:  Chief  of  Police,  Chief 
of  Staff,  Operations,  and  Administrative  Services.  The 
Office  of  Administrative  Services  is  headed  by  an  Assistant 
Chief  and  is  comprised  of  several  divisions  that  provide 
support  to  the  department.  Among  these  divisions  are 
Forensic  Services,  Training,  Technology,  and  Support 
Services.  The  Property  Control  Unit  (PCU)  reports  to  the 
director  of  the  Support  Services  division.  The  PCU  is  led  by 
a lieutenant  who  is  responsible  for  16  uniform  and  civilian 
department  employees. 

The  PCU  is  charged  with  receiving,  storing,  maintaining, 
and  the  disposal  of  all  evidence,  found  property,  and 
property  for  safekeeping  in  a secure  facility.  PCU  staff  pick 
up  monetary  evidence  from  all  district  stations  on  a daily 
basis.  The  PCU  maintains  two  secured  facilities  to  store 
booked1  evidence.  Its  primary  facility  is  located  at  the  Hall 
of  Justice,  and  a secondary  storage  facility  is  located  in  the 
City’s  Bayview  district. 

The  PCU’s  primary  storage  facility  consists  of  various 
rooms  and  areas  for  storing  different  types  of  property  and 
evidence,  including  bicycles,  suitcases,  narcotics,  guns, 
money,  and  jewelry  seized  during  the  course  of  police 
investigations. 

The  department  issues  two  types  of  internal  authoritative 
documents  to  department  members  regarding  its  policies 
and  procedures:  Department  General  Orders  and  Bulletins. 
Department  General  Orders  guide  the  day-to-day  duties  of 
department  members,  and  they  include  both  policies  and 
procedures  of  the  department  and  rules  governing  conduct. 
Department  General  Orders  are  the  most  authoritative 


1 Property  that  has  been  processed  by  department  staff  into  the  property  evidence  system. 
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directives  issued  to  department  members.  They  can  only  be 
adopted  following  a public  hearing  and  subsequent 
approval  by  the  Police  Commission.  Department  General 
Orders  remain  in  effect  until  they  are  amended, 
superseded,  or  rescinded.  Bulletins  can  include  other 
policies  and  procedures  that  must  be  followed  by 
department  members.  Moreover,  they  may  supplement  or 
amend  rules  contained  in  Department  General  Orders. 
Bulletins  are  issued  by  the  Chief  of  Police,  and  remain  in 
effect  for  two  years  following  their  date  of  issuance. 

Department  General  Order  6.02,  Physical  Evidence  and 
Crime  Scenes,  defines  physical  evidence  as  anything  that 
has  been  used,  left,  removed,  altered  or  contaminated 
during  the  commission  of  the  crime  by  victim(s)  or 
suspect(s).2 

Department  General  Order  6.15  states  that  property  is 
divided  into  four  major  categories: 

1 . Property  for  identification  that  consists  of  evidence 
(property  or  money  that  is  related  or  possibly  related 
to  a crime,  except  narcotics),  non-evidence  (found 
property  and  property  for  safe  keeping) 

2.  Narcotics 

3.  Volatile  or  inflammable  substances 

4.  Destructive  devices 

This  audit  examined  only  the  portion  of  property  that 
consists  of  evidence  and  non-evidence  that  has  monetary 
value.  Evidence  and  non-evidence  with  significant 
monetary  value  (monetary  evidence)  includes  currency, 
coins,  precious  metals,  and  jewelry.  Monetary  evidence  is  a 
unique  category  of  evidence  that  is  handled  by  the  PCU 
and  department  members  according  to  specific  policies  and 
procedures,  which  are  outlined  in  both  a subsection  of 
General  Order  6.15  and  in  the  PCU’s  policies  and 
procedures. 

Monetary  evidence  is  packaged  in  specially  printed  storage 
envelopes.  Police  officers  record  required  information  on 
the  front  of  the  envelope,  including  their  names  and  badge 


Discrete  rules  are  in  place 
that  govern  the  handling  of 
monetary  evidence 


Physical  evidence  as  defined  by  Department  General  Order  6.02  is  referred  to  as  “evidence”  in  this  report. 
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PCU  staff  are  responsible  for 
receiving,  logging,  storing, 
securing,  and  eventually 
disposing  of  monetary 
evidence 


numbers,  the  case  number,  incident  date,  type  of  offense, 
and  other  applicable  information.  The  monetary  evidence 
must  include  a count  of  each  denomination  of  currency,  or 
a description  of  any  non-currency  item  that  is  enclosed  in 
the  envelope.  This  report  refers  to  all  such  property  as 
monetary  evidence. 

PCU  staff  do  not  package  monetary  evidence  envelopes. 
Monetary  evidence  envelopes  are  packaged  and  sealed  at 
the  district  station  that  initiates  the  case  with  which  the 
evidence  is  associated.  Any  envelopes  initiated  at  a station 
during  a given  day  are  packaged,  sealed,  logged,  and 
stored  under  lock  until  picked  up  by  PCU  staff.  PCU’s  unit- 
specific  procedures  for  the  handling  of  monetary  evidence 
begin  at  the  point  that  a PCU  staff  member  accepts  the 
sealed  envelopes  from  the  district  stations.  At  the  time  of 
pickup,  PCU  staff  reserve  the  right  to  refuse  to  accept  an 
envelope  if  staff  determines  the  envelope  is  not  properly 
packaged  or  sealed. 

PCU  staff  log  new  monetary  evidence  envelopes  into  two 
separate  systems:  the  Property  Evidence  Tracking  System 
(PETS)  and  manual  log  books.  PCU  staff  create  a new 
PETS  record,  into  which  they  enter  the  information  written 
on  the  front  of  the  envelope  when  it  first  arrives  at  the  unit. 
PCU  staff  also  make  PETS  entries  when  envelopes  are 
signed  out,  released,  or  disposed.  The  second  system  is  a 
manual  set  of  log  books  that  are  used  to  record  the  initial 
arrival  of  an  envelope  into  PCU’s  custody  and  any  check- 
ins and  check-outs  of  an  envelope  between  the  time  it  is 
first  received  and  the  time  it  is  disposed  or  released.  Once 
the  information  has  been  logged,  PCU  staff  file  the 
envelopes  in  one  of  two  safes  maintained  by  the  unit.  An 
envelope  is  disposed  when  its  contents  are  either 
authorized  for  release  or  officially  become  classified  as 
unclaimed.  Unclaimed  money  is  deposited  by  the 
department  into  the  City’s  general  fund. 

PCU  is  responsible  for  routinely  reviewing  the  disposition  of 
all  monetary  evidence  envelopes  in  the  department’s 
inventory.  PCU  procedures  include  three  routine  reviews: 


Monthly:  PCU  distributes  to  relevant  departmental  units 
a PETS  report  that  includes  a listing  of  all  monetary 
evidence  envelopes  that  PCU  has  been  holding  for 
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Objectives 


Scope  and  Methodology 


exactly  15  months.  The  officer  or  inspector  assigned  to 
each  case  indicates  on  this  report  whether  the  envelope 
should  be  held  or  disposed,  and  the  report  is  returned  to 
the  PCU. 

• Annually : PCU  is  required  to  review  the  status  of  all 
envelopes  that  are  on  “hold”  status.  PCU  procedures  do 
not  detail  how  this  annual  review  should  be  conducted. 

• Inventory:  According  to  PCU,  once  per  calendar  year, 
PCU  staff  conduct  an  inventory  of  all  monetary 
evidence  envelopes  to  confirm  that  all  envelopes  shown 
in  the  PETS  system  are  actually  in  PCU  safes. 

The  purpose  of  this  audit  was  to  determine  whether: 

• The  physical  inventory  of  monetary 
property/evidence  envelopes,  held  at  the  PCU’s 
facility,  included  all  items  reported  in  the  property 
inventory  report  from  PETS,  the  department’s 
Property  Evidence  Tracking  System  for  items  stored 
at  the  Hall  of  Justice. 

• Officers  are  properly  packaging  monetary 
property/evidence  to  ensure  its  integrity  and 
credibility. 

• The  PCU  has  adequate  internal  controls  and 
policies  and  procedures  over  safeguarding  of 
monetary  evidence  envelopes  received,  stored,  and 
maintained  by  its  staff. 


The  audit  team  conducted  an  inventory  count  of  all  the 
monetary  evidence  envelopes  contained  in  the  PCU’s 
inventory,  as  of  a PETS  report  dated  April  9,  2010. 
According  to  PETS  records,  the  inventory  included 
envelopes  received  by  the  PCU  between  1983  and  2010. 
The  review  was  primarily  conducted  after  business  hours  to 
avoid  disruptions  to  the  PCU.  During  this  review,  the 
auditors: 

• Inspected  each  individual  envelope  and  noted  the 
following:  the  indicated  dollar  value,  the  type  of  incident 
that  occurred  (narcotics,  robbery,  homicide,  found 
property,  etc.),  and  whether  the  envelope  was 
packaged  and  sealed  according  to  both  departmental 
procedures  and  best  practices  in  public  safety  evidence 
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handling. 

• Confirmed  whether  each  inspected  envelope  was 
included  in  the  PETS  report. 

• Observed  PCU  staff  as  they  opened  and  counted  the 
monetary  contents  of  a sample  of  envelopes  from  the 
inventory. 

Subsequent  to  the  inventory  of  all  monetary  evidence  in  the 
PCU’s  inventory,  the  audit  team: 

• Assessed  the  PCU’s  monetary  property/evidence 
handling  controls  through  review  of  written  policies  and 
procedures  and  interviews  of  PCU  staff. 

• Assessed  the  adequacy  of  PETS  access  controls. 

• Evaluated  the  risks  associated  with  identified 
weaknesses  and  deficiencies  in  the  PCU’s  monetary 
evidence  handling  controls. 

This  performance  audit  was  conducted  in  accordance  with 
generally  accepted  government  auditing  standards.  These 
standards  require  planning  and  performing  the  audit  to 
obtain  sufficient,  appropriate  evidence  to  provide  a 
reasonable  basis  for  the  findings  and  conclusions  based  on 
the  audit  objectives.  The  audit  team  believes  that  the 
evidence  obtained  provides  a reasonable  basis  for  the 
findings  and  conclusions  based  on  the  audit  objectives. 
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CHAPTER  1 - The  Property  Control  Unit  Can 
Account  for  the  Monetary  Evidence  in  its  Inventory 
but  Needs  to  Improve  Some  of  Its  Controls 


THE  PCU  ACCOUNTED  As  of  April  9,  2010,  the  Property  Evidence  Tracking  System 
FOR  ITS  INVENTORY  OF  (PETS)  documented  that  the  PCU  had  7,300  envelopes  in 
MONETARY  EVIDENCE  its  possession  that  contained  monetary  evidence.  The 

auditors  accounted  for  the  7,300  envelopes  and  found  no 
indication  that  any  monetary  evidence  had  been 
misappropriated. 


Auditors  physically  counted  7,225  monetary  evidence 
envelopes  during  the  inventory  count;  75  items  were 
subsequently  accounted  for  as  either  released  or  signed-out 
to  an  officer  or  an  inspector.  The  auditors  did  not  physically 
open  any  envelopes  to  confirm  whether  the  amounts  of 
cash  recorded  as  being  in  the  envelopes  was  correct.  In 
addition  to  confirming  the  existence  of  each  envelope, 
auditors  inspected  each  envelope  to  determine  whether  the 
envelope  was  packaged  and  sealed  in  compliance  with 
procedures  stated  in  Department  General  Order  6.15,  dated 
July  27,  1994. 

Department  General  Order  6.15  requires  that  officers 
package  monetary  evidence  in  dedicated  envelopes  with 
the  amounts  written  in  both  figures  and  words  by  the 
submitting  officer.  It  mandates  that  both  the  officer 
packaging  the  money  and  the  station  keeper  sign  their 
initials  and  star  (badge)  numbers  on  the  back  flap  of  the 
envelope,  and  that  the  envelope  is  sealed  with  transparent 
tape.  The  auditors  found  that  department  officers  did  not 
consistently  follow  these  procedures  when  packaging  and 
sealing  money  evidence  envelopes. 

Finding  1.1  Department  officers  did  not  consistently  follow 

established  procedures  to  ensure  monetary  evidence 
envelopes  were  properly  packaged  and  sealed. 

Of  7,225  envelopes  counted,  2,769  (38.3  percent)  were  not 
properly  packaged  and  sealed  by  department  officers  in 
accordance  with  Department  General  Order  6.15.  For 
example,  envelopes  lacked  initials  and  star  numbers,  and 
were  not  properly  sealed  with  transparent  tape.  A number 
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of  envelopes  had  more  than  one  of  these  compliance 
issues.  The  Exhibit  summarizes  the  results  of  the 
compliance  review. 


EXHIBIT 


Inventory  count  statistics 


Envelopes  Not  Compliant 
with  Established 
Department  Procedures 


Envelopes  Compliant 
with  Both  Established 
Department  Procedures 
and  Best  Practices  in 
Evidence  Handling 


14.4% 


Envelopes  Compliant 
with  Established 
Department  Procedures 


Note:  Compliance  review  did  not  include  the  75  envelopes  that  were  signed  out  or  released. 
Source:  Auditor  analysis 


The  PCU  also  has  its  own  written  procedures  for 
transferring  monetary  evidence  envelopes  from  district 
stations  to  the  PCU  for  safekeeping.  According  to  its 
procedures,  PCU  personnel  are  to  carefully  examine  the 
envelopes  to  ensure  they  are  properly  packaged  and 
sealed.  If  they  are  not,  the  PCU  has  the  right  to  refuse  to 
accept  the  envelope.  Nevertheless,  the  PCU  accepted 
many  envelopes  (38.3  percent)  that  were  not  properly 
packaged  and  sealed.  The  auditors  did  not  conduct  a 
detailed  review  of  individual  non-compliant  envelopes  to 
determine  why  PCU  did  not  refuse  to  accept  them. 
However,  the  auditors  did  verify  that  PCU’s  procedures  do 
reference  a “right  of  refusal”  policy,  but  the  policy  is  not 
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Recommendations 


Finding  1.2 


documented  in  writing. 

In  addition  to  reviewing  whether  envelopes  were  sealed 
according  to  departmental  procedures,  the  auditors  also 
reviewed  whether  department  members  sealed  envelopes 
according  to  best  practices  in  evidence  handling.  Best 
practices  call  for  evidence  envelopes  to  be  taped  and 
signed  over  all  potential  entry  locations,  which  include 
envelope  seams  that  may  come  pre-glued.  Of  the  7,225 
envelopes  counted,  1,038  (14.4  percent)  met  this  more 
stringent  standard,  which  goes  beyond  the  department’s 
procedures. 

The  San  Francisco  Police  Department  should: 

1 . Issue  a Department  Bulletin  that  details  specific 
procedures  required  of  officers  when  packaging  and 
sealing  monetary  evidence  envelopes. 

2.  Ensure  all  department  officers  are  fully  and  adequately 
trained  on  proper  monetary  evidence  packaging  and 
sealing  procedures. 

3.  Include  in  the  recommended  Bulletin,  PCU’s  stated 
“right  of  refusal”  policy  in  order  to  re-affirm  that  PCU 
staff  have  the  authority  to  refuse  the  transfer  of 
monetary  evidence  envelopes  that  are  not  properly 
packaged  and  sealed. 

PETS  does  not  accurately  report  the  dollar  value  of 
monetary  evidence  in  the  PCU  safes. 

PETS  contains  errors  in  the  dollar  amounts  recorded  for 
monetary  evidence  envelopes  retained  for  safekeeping  by 
the  PCU.  PETS  shows  235  envelopes  as  having  a 
monetary  value  of  $0.  For  many  of  these  report  entries,  the 
amount  field  shows  no  dollar  value;  however,  the  dollar 
amount  indicated  on  the  envelope  is  documented  in  the 
description  field  of  the  report.  According  to  PCU  staff, 

PETS,  which  is  administered  by  the  City’s  Department  of 
Technology  (DT),  does  not  allow  the  dollar  amount  field  to 
be  altered.  Once  an  entry  is  made,  it  cannot  be  corrected 
for  data  errors  or  updated  to  account  for  known 
discrepancies.  To  make  corrections,  PCU  staff  must  add  an 
entry  of  the  actual  value  to  the  description  field  for  that 
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Finding  1.3 


record.  On  further  examination  of  the  amounts  written  on 
the  actual  envelopes,  the  auditors  found  that  189  of  the  235 
envelopes  had  recorded  monetary  values,  totaling  $80,320. 

In  addition  to  records  with  $0  amounts  listed,  amounts 
indicated  on  59  other  envelopes  did  not  correspond  to  the 
amounts  indicated  in  the  PETS  records.  The  total  of  these 
discrepancies  was  $125,797.  Further  review  of  these 
envelopes  and  the  PETS  record  history  showed  that  some 
of  these  discrepancies  were  documented  in  the  description 
field  and  were  caused  by  data  entry  errors  or  partial  release 
of  items.  This  $125,797  discrepancy  represents  another 
example  of  PETS  not  accurately  reflecting  an  accurate  total 
of  monetary  evidence  held  at  the  PCU. 

The  San  Francisco  Police  Department  should: 

4.  Advise  the  department’s  Technology  Division  and  the 
PCU  to  work  with  Department  of  Technology  to 
investigate  what  changes  to  PETS  access  controls  or 
programming  would  be  required  to  allow  the  dollar 
amount  field  to  be  updated  in  specifically  defined 
circumstances. 

5.  Keep  a record  of  all  known  discrepancies  between  the 
amount  shown  in  PETS  and  the  actual  amount  recorded 
on  monetary  evidence  envelopes  in  PCU  custody,  and 
conduct  a monthly  reconciliation  to  PETS  reports  to 
ensure  all  amounts  in  the  safes  are  accurately  recorded 
in  PETS. 

The  amounts  recorded  on  monetary  evidence 
envelopes  are  not  always  equal  to  contents. 

Of  the  380  envelopes,  9 (two  percent)  contained  amounts 
that  did  not  match  the  amounts  recorded  in  PETS  or  the 
amount  indicated  on  the  envelope.  The  9 discrepancies 
included  both  overages  and  shortages  when  compared  to 
the  amounts  recorded  in  PETS.  In  total,  the  9 envelopes 
contained  $255  more  in  cash  than  the  amounts  recorded  in 
PETS  and  on  the  individual  envelopes. 

Following  established  PCU  procedures,  the  only  time  a 
discrepancy  is  discovered  between  the  amount  initially 
recorded  on  the  monetary  evidence  envelope  and  the 
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Finding  1.4 
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amount  actually  enclosed  is  when  currency  is  fully  or 
partially  released.  PCU  procedures  state  that  PCU 
personnel  do  not  inspect  the  contents  of  envelopes  at  any 
time  during  the  booking  procedure  or  during  their  shelf  life. 
The  amount  written  on  the  envelope  at  the  station  by  the 
officer,  and  verified  by  a second  officer,  is  taken  at  face 
value  and  is  recorded  into  PETS.  It  is  therefore  important 
that  officers  accurately  record  the  dollar  amounts  on  the 
envelopes,  and  that  the  PCU  accurately  enters  the 
information  into  PETS. 

During  the  inventory  count  by  auditors,  the  department 
elected  to  test  for  potential  discrepancies  by  having  PCU 
staff  open  and  count  the  money  contained  in  a sample  of 
380  envelopes.  The  auditors  did  not  open  envelopes  or 
count  money,  but  only  observed  PCU  staff  in  conducting 
the  count.  PCU  assured  the  auditors  that,  during  the 
counting  and  the  re-sealing  of  sample  envelopes,  it 
complied  with  all  department  procedures  to  maintain  the 
integrity  of  the  evidence  in  the  envelopes. 

The  San  Francisco  Police  Department  should: 

6.  Ensure  that  its  officers  accurately  record  the  dollar 
amounts  on  the  monetary  evidence  envelopes,  and  that 
amounts  are  accurately  entered  into  PETS. 

The  department  needs  to  improve  its  procedures  for 
sealing  monetary  evidence  envelopes. 

Department  guidance  regarding  the  packaging  and  sealing 
of  monetary  evidence  is  incomplete  and  out-of-date. 
General  Order  6.15  includes  instructions  on  the  sealing  of 
monetary  evidence  envelopes  that  do  not  provide  enough 
details  to  completely  guide  officers  through  the  process  of 
adequately  packaging  and  sealing  the  envelopes.  Both  the 
general  order  and  the  PCU  procedures  call  for  the  preparer 
and  verifier  to  initial  the  back  flap  of  the  envelope,  as  well 
as  indicating  their  star  numbers.  Further,  the  procedures 
require  the  envelope  to  be  sealed  with  transparent  tape. 

The  San  Francisco  Police  Department  should: 

7.  Obtain  monetary  evidence  envelopes  specifically 
designed  to  maintain  the  integrity  of  the  money 
contained  in  the  envelope.  Such  envelopes  would  only 
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have  one  opening. 

8.  Issue  updated  guidance  that  requires  current  monetary 
evidence  envelopes  to  be  taped  and  signed  across  all 
three  of  the  envelope’s  entry  points,  until  it  implements 
the  new  envelope. 

9.  Consider  adding  user-based  security  access  to  PETS, 
which  would  allow  only  current  PCU  staff  to  have 
access  to  modify  PETS  records. 
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CHAPTER  2 - The  Department  Needs  to  Strengthen 
Controls  Over  Access  to  Electronic  Data 


Finding  2.1 

Access  controls  to  property  evidence  data  need  to  be 
strengthened. 

The  computer  system  used  by  the  department  to  manage 
property  and  evidence  is  antiquated,  and  the  security 
measures  used  to  protect  the  integrity  of  electronic  data  are 
not  consistent  with  current  industry  standards. 

PETS  is  an  old  system  that  is 
managed  using  out-of-date 
system-security  measures 

The  department’s  Property  Evidence  Tracking  System 
(PETS)  is  a mainframe  subsystem  that  was  implemented  in 
1982.  The  mainframe  computer  that  runs  PETS  is  located 
outside  the  department  and  is  managed  by  the  City’s 
Department  of  Technology  (DT).  PETS  is  accessed  by 
individual  computer  terminals  that  are  administered  by  the 
department’s  Technology  Division. 

According  to  a sergeant  of  the  department’s  Technology 
Division,  all  terminals  in  the  department  have  read-only 
access  to  PETS.  However,  certain  designated  terminals 
also  have  access  that  allows  users  to  enter  and  modify 
PETS  data.  Therefore,  a user’s  ability  to  modify  PETS 
records  is  primarily  dependent  on  whether  he  is  sitting  at  a 
designated  terminal;  there  are  no  user-specific  access 
controls  for  modifying  data. 

Access  to  terminals  with 
modify  access  to  PETS  needs 
to  be  more  effectively 
controlled 

DT  staff  provided  a system  report  showing  a list  of  28 
terminals  that  currently  have  access  to  modify  PETS 
records.  While  DT  manages  the  mainframe  and  is 
responsible  for  making  any  requested  changes  to  the  list  of 
approved  terminals,  it  is  the  responsibility  of  the  department 
to  track  where  the  terminals  are  located  and  to  control  who 
has  access  to  them.  Department  staff  indicated  that 
terminals  with  access  to  modify  PETS  should  only  be 
located  in  the  PCU’s  work  area.  However,  during  the 
course  of  the  field  work,  auditors  were  not  able  to  obtain  a 
current  list  showing  the  physical  location  of  each  of  the  28 
terminals  shown  on  the  system  report. 

Although  access  to  the  PCU  facility  is  controlled,  and  only 
assigned  PCU  staff  should  be  able  to  access  the  terminals, 
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Finding  2.2 
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the  current  security  protocol  should  be  improved  to  further 
ensure  that  there  is  no  unauthorized  access  to  PETS. 

Under  the  current  protocol,  a member  of  the  department 
who  is  not  assigned  to  the  PCU  could  access  and  modify 
PETS  records  if  sitting  at  a terminal  in  the  PCU,  because  all 
department  users  are  granted  access  to  the  computer 
network. 

The  San  Francisco  Police  Department  should: 

10.  Produce  a current  list  identifying  the  location  of  all  28 
terminals  that  currently  have  access  to  modify  PETS, 
and  consider  whether  any  of  these  28  should  have  their 
access  adjusted. 

The  PCU  does  not  conduct  routine  reviews  to  ensure  it 
has  a current  list  of  authorized  PETS  users. 

The  PCU  does  not  conduct  a periodic  review  of  user- 
access  rights  to  confirm  that  only  authorized  individuals 
have  access  to  modify  PETS  records.  Periodic  review  and 
updating  of  lists  of  authorized  users  of  department 
computer  systems  are  necessary  because  a user  may  have 
left  the  department,  or  may  have  changed  job 
responsibilities  and  no  longer  require  special  access  rights 
to  a unit-specific  system  such  as  PETS.  By  failing  to 
conduct  routine  user-access  reviews,  the  PCU  increases 
the  risk  that  unauthorized  persons  may  have  access  to 
PETS. 

The  San  Francisco  Police  Department  should: 

1 1 . Conduct  a periodic  review  of  its  PETS  users  to  ensure 
that  current  users’  access  rights  are  appropriate  based 
on  their  job  functions,  terminated  members  are  removed 
timely,  and  that  access  rights  for  new  users  are 
approved  by  management. 
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CHAPTER  3 - The  Property  Control  Unit  Needs  to 
Improve  and  Update  Its  Policies  and  Procedures  for 
Handling  Monetary  Evidence 


Finding  3.1  The  PCU  does  not  maintain  current  policies  and 

procedures  for  handling  monetary  evidence. 

The  PCU  has  not  updated  its  monetary  evidence 
procedures  for  more  than  12  years.  The  auditors  reviewed 
the  PCU’s  currency  procedures  for  the  following  activities: 

• Picking  up  monetary  evidence  from  district  stations. 

• Booking  monetary  evidence  to  the  PCU’s  computer  and 
log-book  systems. 

• Releasing  monetary  evidence. 

The  policies  and  procedures  provided  by  PCU  command 
staff  were  prepared  and  last  updated  in  1998.  Department 
staff  were  not  able  to  locate  any  updated  or  revised 
Department  Bulletins  related  to  the  handling  of  evidence. 

The  PCU’s  current  practices  for  the  handling  of  monetary 
evidence  are  not  completely  consistent  with  the  unit’s 
written  policies  and  procedures.  PCU  staff  accepted 
monetary  envelopes  from  district  stations  although  the 
stations  did  not  always  comply  with  the  requirements  and 
procedures  outlined  in  General  Order  6.15,  which 
addresses,  in  part,  the  handling  of  monetary  evidence.  For 
example,  the  auditors  identified  envelopes  that  were  not 
signed  by  one  or  more  individuals,  envelopes  that  were  not 
sealed  with  tape,  and  envelopes  that  did  not  contain  an 
individual’s  star  number. 

In  some  instances,  the  PCU  accepted  monetary  evidence 
from  district  stations  even  when  the  monetary  evidence  did 
not  meet  PCU’s  own  requirements.  For  example,  PCU  staff 
accepted  envelopes  containing  money  although  the 
stations  did  not  properly  indicate  on  the  envelope  that  the 
amount  was  verified  by  someone  other  than  the  individual 
who  counted  the  currency,  and  in  cases  in  which  one  or 
more  individuals  signed  their  initials  and  star  number  on  an 
area  of  the  envelope  other  than  the  flap. 


Currency  procedures  require 
improvement 
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Disposal  procedures  also 
should  be  improved 


Recommendations 
Finding  3.2 

Monthly  reviews  are  properly 
initiated 


PCU  staff  did  not  follow  all  the  unit’s  procedures  related  to 
the  disposal  of  monetary  evidence,  and  the  PCU’s  current 
practices  in  this  area  are  not  consistent  with  its  written 
policies  and  procedures.  For  instance,  under  its  policy,  the 
PCU  is  to  provide  a specific  form  that  department  units  are 
to  fill  out  when  reviewing  the  list  of  evidence  that  is  15 
months  old  and  is  subject  to  disposal  if  no  longer  needed. 
However,  the  PCU  no  longer  requires  department  units  to 
submit  this  specific  form,  but  instead  requires  them  to  sign 
a monthly  hold  and  disposal  checklist  to  document  that  the 
units  have  reviewed  the  listing  of  evidence  that  may  be 
disposed. 

In  another  departure  from  its  policies  and  procedures,  the 
PCU  does  not  require  the  Deputy  Chief  of  Administration  to 
be  notified  if  units  do  not  return  their  responses  with  30 
days  of  receiving  the  monthly  disposal  list.  Instead,  the 
PCU’s  practice  is  for  its  lieutenant  to  contact  the  captain  of 
the  Investigations  Bureau  and  notify  the  captain  of  the  units 
that  have  not  responded.  According  to  the  PCU,  this  is  a 
result  of  recent  organizational  restructuring  within  the 
department. 

The  San  Francisco  Police  Department  should: 

12.  Advise  the  Property  Control  Unit  to  update  its  policies 
and  procedures  to  reflect  current  practices,  as  well  as  to 
take  into  account  any  department-issued  orders, 
bulletins,  and  memoranda  that  may  affect  the  PCU’s 
practices. 

The  PCU  conducts  monthly  reviews  of  aged  items  but 
does  not  perform  routine  annual  reviews. 

The  PCU  adheres  to  its  procedures  for  conducting  monthly 
reviews  of  the  monetary  evidence  that  has  been  held  for  15 
months.  Each  month,  the  PCU  requests  from  DT  a PETS 
report  showing  all  currency  envelopes  that  have  been 
stored  at  the  PCU  for  1 5 months.  The  report  is  processed 
according  to  PCU’s  written  “Hold  and  Destruction  Cycle” 
procedures.  As  part  of  this  process,  the  PCU  distributes  the 
report  to  all  department  units,  and  the  units  certify  receipt  of 
the  report  by  dating  and  signing  a form.  The  officer 
assigned  to  the  case  for  which  the  evidence  is  being  held 
indicates  on  the  report  whether  the  evidence  is  to  be  further 
held  or  disposed,  and  the  officer-in-charge  of  that  unit  signs 
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Disposition  instructions 
received  via  the  monthly 
reviews  are  not  acted  upon 
timely 


Required  annual  reviews  of 
held  items  are  not  routinely 
performed 


each  page  of  the  report  to  indicate  approval  of  the 
disposition  instructions.  The  original  report  document  is 
then  returned  to  the  PCU,  which  destroys  the  items 
identified  for  destruction  and  retains  the  items  identified  to 
be  further  held  in  storage. 

PCU  initiates  the  monthly  review  required  by  its 
procedures,  but  PCU  staff  do  not  complete  the  processing 
of  instructions  received  from  case  officers  in  a timely 
manner.  Case  officers  indicate  on  the  monthly  report 
whether  envelopes  should  be  held  or  released.  Released 
money  is  either  returned  to  an  individual  or  deposited  into 
the  City’s  general  fund  if  it  is  classified  as  unclaimed. 

The  audit  team’s  analysis  of  PETS  records  showed  that 
955  of  the  7,300  monetary  evidence  envelopes  had 
exceeded  the  15-month  hold  and  destruction  cycle  but 
contained  no  entry  in  PETS  to  indicate  what  instruction  had 
been  given  by  the  case  officer  during  the  monthly  review. 
PETS  records  show  that  these  envelopes  contained  a total 
of  $252,354.  Auditors  did  not  conduct  a detailed  analysis  of 
the  disposition  of  each  these  envelopes,  but  PCU 
procedures  require  that  these  items  should  have  been 
approved  for  either  hold  or  release. 

Although  the  PCU  completes  the  required  monthly  review,  it 
does  not  routinely  perform  the  annual  review  of  aged 
inventory  that  has  been  on  hold  at  the  PCU  for  over  18 
months.  This  separate  review  is  also  required  by  PCU’s 
policies  and  procedures.  According  to  the  PCU  lieutenant,  a 
review  of  all  held  envelopes  has  not  been  conducted  during 
his  two  and  one-half  years  with  the  PCU.  As  a result,  the 
PCU  cannot  easily  identify  the  total  dollar  amount  of  items 
whose  shelf-life  has  exceeded  18  months,  and  is  potentially 
not  identifying  monetary  evidence/property  that  can  be 
released  or  deposited  into  the  City’s  general  fund.  This 
separate,  annual  review  of  held  items  is  necessary  because 
the  monthly  review  process  only  looks  at  envelopes  that 
have  just  reached  the  15-month  point.  The  monthly  review 
does  not  consider  envelopes  that  have  been  held  by  the 
PCU  for  16  months  or  longer. 

In  addition  to  finding  that  the  required  annual  review  of  held 
envelopes  is  not  routinely  conducted,  the  auditors  found 
that  the  PCU  does  not  have  specific  procedures  for 
conducting  the  annual  reviews.  PCU’s  procedures  state 
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than  an  annual  review  is  required,  but  they  do  not  detail 
how  the  review  should  be  conducted. 

The  San  Francisco  Police  Department  should  require  the 
PCU  to: 

13.  Develop  and  implement  routine  review  procedures  for 
monetary  evidence  and  property  that  has  been  stored 
for  greater  than  18  months. 

14.  Revise  its  policies  and  procedures  to  reflect  current 
practices  and  implementation  of  additional,  revised,  and 
comprehensive  procedures. 

15.  Process  the  955  aged  envelopes  that  should  by  now 
have  received  disposition  instructions  from  their  case 
officers  through  the  monthly  review  process. 
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CHAPTER  4 - The  Department  Should  Improve  Its 
Oversight  and  Monitoring  of  Receipt  and  Storage  of 
Monetary  Evidence 


The  department  and  the  PCU  have  a number  of  satisfactory 
procedures  in  place  to  control  monetary  evidence.  For 
example,  PCU  staff  do  not  open  monetary  evidence 
envelopes  while  they  are  in  PCU  custody.  The  PCU  staff 
store  the  envelopes  in  safes,  to  which  access  is  limited,  and 
retain  records  of  the  stored  evidence  envelopes  in  two 
separate  systems  that  can  be  reconciled  to  ensure  all 
envelopes  are  accounted  for.  However,  improvements  are 
needed  to  the  oversight  and  monitoring  of  monetary 
evidence. 

Finding  4.1  The  department  and  the  PCU  have  inadequate 

segregation  of  money  handling  duties. 

PCU  does  not  have  job  descriptions  to  clearly  define  the 
roles  and  responsibilities  of  each  staff  member  related  to 
the  handling  of  monetary  evidence  envelopes. 

The  auditors  assessed  whether  PCU  staff  performing  the 
procedures  and  controls  observed  as  part  of  the  audit  held 
any  conflicting  duties,  and  whether  any  potential  conflicting 
duties  are  adequately  addressed  in  the  design  of  the  PCU’s 
procedures  and  controls.  The  auditors  determined  that 
authorization,  processing,  record  keeping,  asset  custody, 
and  reporting  should  not  all  be  performed  by  the  same 
person.  Better  segregation  of  duties  would  provide 
assurance  that  no  one  person  is  performing  conflicting 
duties  in  the  course  of  performing  everyday  activities. 

Proper  segregation  also  serves  to  protect  employees  from 
allegations  of  wrongdoing. 

The  auditors  did  not  conduct  detailed  observations  or 
testing  to  confirm  all  ways  in  which  PCU’s  actual  practices 
may  be  incompatible  with  adequate  segregation  of  duties. 
The  auditors’  analysis  did  show  that  written  procedures  do 
not  prohibit  PCU  staff  from  performing  incompatible  duties. 
For  example  the  lieutenant  who  manages  the  PCU  and 
authorizes  bank  deposits  is  not  prohibited  from  preparing  or 
making  the  deposit.  Proper  segregation  would  have  one 
staff  person  prepare  and  sign  the  deposit  (preparation)  and 
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Recommendation 


Finding  4.2 


the  lieutenant  review  and  approve  the  deposit 
(authorization). 

The  San  Francisco  Police  Department  should: 

16.  Develop  and  implement  updated  procedures  and  job 
descriptions  that  incorporate  sound  segregation  of 
duties  throughout  PCU’s  monetary  evidence  handling 
activities. 

Additional  training  in  monetary  evidence  handling 
needs  to  be  provided. 

The  department  does  not  provide  periodic  training  to 
officers  for  handling  monetary  evidence.  According  to  PCU 
and  district-station  staff,  officers  receive  their  primary 
training  in  monetary  evidence  handling  during  their  initial 
training  at  the  police  academy.  Academy  students  receive 
classroom  training  in  general  order  requirements,  and  then 
have  an  opportunity  to  practice  packaging  monetary 
evidence  during  the  field  training  portion  of  the  academy 
training.  Upon  completion  of  their  academy  training,  officers 
are  eligible  for  field  training  every  two  years.  According  to  a 
field  training  sergeant,  the  scope  of  this  training  is  broad, 
and  it  may  change  each  training  cycle.  It  may  or  may  not 
include  any  information  regarding  monetary  evidence 
handling. 

Furthermore,  the  department  does  not  have  sufficient 
training  or  guidance  materials  to  aid  officers  in  handling 
monetary  evidence.  Officers  from  eight  district  stations 
reported  that  they  have  received  no  additional  written 
guidance  outside  of  the  Department  General  Order  6.15  for 
handling  monetary  evidence.  As  discussed  in  Chapter  1, 
this  order  does  not  contain  comprehensive  procedures  to 
assist  the  officers  in  handling  monetary  evidence. 

The  PCU  also  needs  to  improve  the  training  of  its  staff  in 
the  specific  procedures  it  uses  to  log  and  track  monetary 
evidence  envelopes.  Although  the  PCU  has  written 
procedures  and  training  materials  to  assist  staff  in  using  its 
system  of  log  books,  the  critical  PETS  application 
reportedly  has  no  user  manual.  PCU  staff  indicated  that 
new  members  of  the  unit  are  trained  on  PETS  by  having  an 
existing  staff  member  sit  with  them  and  verbally  walk  them 
through  how  to  make  entries  into  the  system. 
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Recommendations 


Finding  4.3 


Recommendation 


Accountability  for  the  proper  receipt,  storage,  and 
maintenance  of  monetary  evidence  would  be  increased 
through  better  documented  and  more  regular  training 
activities. 

The  San  Francisco  Police  Department  should: 

17.  Issue  routine  and  comprehensive  guidance  to  all 
officers  and  district  stations  regarding  proper  monetary 
evidence  handling  procedures. 

18.  Advise  the  PCU  to  work  with  the  department’s 
Technology  Division  and  the  City’s  Department  of 
Technology  to  develop  a user  reference  and  training 
manual  for  PETS. 

The  PCU  produces  no  routine  management  reports. 

The  PCU  does  not  submit  any  regular  reports  to  senior 
department  management  regarding  its  monetary  evidence 
inventory.  According  to  the  PCU  lieutenant,  the  unit  has  not 
provided  any  reports  to  the  Office  of  the  Chief  of  Police 
during  the  two  and  one-half  years  the  lieutenant  has  been 
assigned  to  the  PCU. 

In  the  course  of  its  normal  operations,  the  PCU  accepts 
new  inventory  and  makes  releases  or  deposits  from 
existing  inventory  on  a monthly  basis.  Therefore,  the 
precise  makeup  of  the  PCU’s  inventory  is  constantly  in  flux. 
The  PCU’s  inventory  of  7,300  envelopes  containing  more 
than  $3.58  million  clearly  defines  it  as  a significant 
operation  worthy  of  routine  attention  from  senior 
management.  Accountability  for  the  disposition  of  items  in 
the  PCU’s  inventory  would  be  increased  if  senior 
management  was  routinely  provided  with  summary 
descriptive  information  regarding  the  monetary  evidence 
currently  in  PCU’s  custody  as  well  as  the  money  that  is 
deposited  into  the  City’s  general  fund  each  month. 

The  San  Francisco  Police  Department  should: 

19.  Develop  a monthly  or  quarterly  report  through  which  the 
PCU  can  provide  department  management  with 
summary  descriptive  information  regarding  the  money 
evidence  inventory. 
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APPENDIX  A:  DEPARTMENT  RESPONSE 


POLICE  DEPARTMENT 

CITY  AND  COUNTY  OF  SAN  FRANCISCO 


THOMAS  J.  CAHILL  HALL  OF  JUSTICE 
350  BRYANT  STREET 

SAN  FRANCISCO,  CALIFORNIA  94103  4503 


GEORGE  GASC6N 

CHIEF  OF  FOUCE 


May  19,2010 


Tonia  Lediju 

Director  of  Audits 

Office  of  the  Controller 

City  and  County  of  San  Francisco 

City  Hall 

1 Dr.  Carlton  B.  Goodlctt  Place,  Room  477 
San  Francisco,  California  94102 

Re:  Audit  report  on  the  San  Francisco  Police  Department’s  Properly  Control  Unit. 

Dear  Ms.  Lediju: 

Enclosed  herewith  kindly  find  the  Police  Department’s  completed  recommendation  and  response 
form  concerning  the  above  referenced  audit.  On  behalf  of  the  members  of  the  Property  Control 
Division  (PCD)  l want  to  thank  you  and  your  staff  for  your  collegial  and  collaborative  approach 
while  conducting  an  inventory  and  audit  of  the  contents  of  our  PCD  safe  and  evaluating  the 
Department’s  money  handling  policies.  Your  report  is  an  important  component  in  the  Police 
Department’s  Management  Analysis  and  Audit  of  its  property  handling  systems. 

The  Controller’s  inventory  and  audit  of  the  Property  Control  Division’s  (PCD)  safe  has  provided 
the  Police  Department  (SFPD)  with  important  recommendations  to  consider  as  we  evaluate  our 
entire  property  processing  system.  Your  report's  confirmation  that  the  contents  of  the  safe,  which 
includes  7,300  monetary  evidence  envelopes,  are  all  accounted  for  and  that  there  is  no 
indication  that  any  monetary  evidence  had  been  misappropriated  confirms  that  while  some  of  our 
practices  need  updating,  the  security  of  our  system  is  sound. 

To  continue  in  the  spirit  of  collaboration,  this  letter  will  provide  further  context  to  your  findings 
and  to  clarify  some  items  in  the  report. 

Findings  and  Responses 

Finding  1.1,  “Department  officers  did  not  consistently  follow  established  procedures  to 
ensure  monetary  evidence  envelopes  were  properly  packaged  and  sealed.” 

T he  audit  revealed  that  the  internal  policies  and  procedures  of  the  PCD  and  Department  General 
Order  (DGO)  6.15  (Property  Processing)  are  not  congruent  in  some  regards.  DGO  6.15  was 
issued  in  July  of  1994  and  has  not  been  amended  since.  The  internal  policies  and  procedures  of 
the  PCD  were  written  in  1998  and  reflected  the  “best  practices”  for  packaging  monetary 
evidence  at  the  time.  DGO  6.15  has  been  augmented  with  policies  contained  in  Department 
Bulletins  (DB).  In  light  of  preliminary  audit  findings,  on  April  27,  2010  the  Police  Department 
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issued  DB10-115  which  updates  DGO  6.15  with  policies  for  processing  of  monetary  evidence.  A 
copy  of  DB  10-1 15  is  attached  for  your  review. 

Controller ’s  recommendations  made  in  response  to  Finding  1. 1 are: 

1 . Issue  a Department  Bulletin  that  details  specific  procedures  required  of  officers  when 
packaging  and  sealing  monetary  evidence  envelopes. 

2.  Ensure  all  department  officers  are  fully  and  adequately  trained  on  proper  monetary 
evidence  packaging  and  sealing  procedures. 

3.  Include  in  the  recommended  Bulletin  PCU’s  stated  “right  of  refusal”  policy  to  re-affirm 
that  PCU  staff  have  the  authority  to  refuse  the  transfer  of  monetary  evidence  envelopes 
that  are  not  properly  packaged  and  sealed. 

SFPD  response: 

l he  three  recommendations  are  addressed  by  DB10-115.  which  states  the  current  department 
policy  applicable  to  all  members.  Each  member  is  issued  a copy  of  the  DB  and  is  required  to 
process  monetary  evidence  in  accord  therewith.  Moreover,  supervisors  arc  required  to  participate 
in  the  processing  of  monetary  evidence. 

Finding  1.2  “PETS  docs  not  accurately  report  the  dollar  value  of  monetary  evidence  in  the 
PCD  safe.” 

Court  will  sometimes  approve  a partial  release  of  monetary  evidence  from  a monetary  evidence 
envelope.  Unfortunately,  the  PETS  system  does  allow  users  to  modify  the  original  amount  that 
was  entered  into  the  system.  Tliis  system  limitation  creates  discrepancies  between  the  computer 
records  and  PCU  written  logs.  The  PE'l'S  description  field  is  modifiable  and  often  this  is  where 
changes  to  the  amount  contained  within  an  envelope  are  documented,  as  well  as  in  the  log  book. 

The  PETS  system  contained  incorrect  entries  for  59  envelopes  that  were  caused  by  data  entry 
errors  or  were  the  result  of  partial  releases  that  were  not  accurately  reflected  in  PETS.  A hand 
check  of  the  corresponding  log  book  entries  for  all  of  these  envelopes  shows  that  the  proper 
entries  were  made  in  the  book  despite  the  lack  of  changes  made  in  PETS. 

Controller’s  recommendations  made  in  response  to  Finding  1.2  are: 

4.  Advise  the  department’s  Technology  Division  and  the  PCU  to  work  with  DT  to 
investigate  what  changes  to  PETS  access  controls  or  programming  would  be  required  to 
allow  the  dollar  amount  field  to  be  updated  in  specifically  defined  circumstances. 

5.  Keep  a record  of  all  known  discrepancies  between  the  amount  shown  in  PETS  and  the 
actual  amount  recorded  on  monetary  evidence  envelopes  in  PCU  custody,  and  conduct  a 
manual,  monthly  reconciliation  to  PETS  reports  to  ensure  all  amounts  in  the  safes  are 
reflected  accurately. 
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SFPD  response: 

We  concur  with  the  recommendations  and  have  begun  to  collaborate  with  Department  of 
Technology  and  Informational  Services  (DTIS)  and  the  SFPD  Information  Technology  (IT)  unit 
to  develop  strategies  to  replace  or  update  PETS  to  support  best  practices  policies.  This 
recommendation  will  also  be  considered  as  the  department  evaluates  IT  solutions  as  part  of  its 
currently  ongoing  Management  Analysis  and  Audit  of  its  property  processing  systems.  PCD 
management  has  conducted  training  for  their  members  assigned  to  enter  monetary  evidence  into 
PETS  and  will  develop  procedures  to  reconcile  PETS  reports  on  a monthly  basis. 

Finding  1.3,  “The  amounts  recorded  on  monetary  evidence  are  not  always  accurate.” 

Current  SFPD  policies  and  procedures,  industry  “best  practices”  and  PCD  policy  preclude 
members  of  PCD  from  opening  every  item  of  evidence  that  is  packaged  and  booked  into 
evidence,  including  monetary  evidence.  Tlte  SFPD  currently  employs  a two-person  rule  for  the 
counting  of  monetary  evidence.  During  the  course  of  the  audit  380  monetary  evidence  envelopes 
were  opened  by  members  of  the  PCD  (in  the  presence  of  Controller’s  staff).  Nine  envelopes 
contained  a total  of  $255.06  more  in  cash  than  was  recorded  on  the  evidence  envelope.  Seven  of 
the  nine  envelopes  contained  more  money  than  what  was  stated  on  the  envelope  and  two  of  the 
nine  envelopes  overstated  the  contents  by  a grand  total  of  $1 .50. 

Controller’s  recommendation  made  in  response  to  Finding  1.3  is: 

6.  Ensure  that  its  officers  accurately  record  the  dollar  amounts  on  the  monetary  evidence 
envelopes,  and  that  amounts  are  accurately  entered  into  PETS. 

SFPD  response: 

We  also  concur  with  this  recommendation.  Officers  in  the  field  are  responsible  for  recording  the 
proper  amount  of  the  monetary  evidence  on  the  envelope.  DB  10-115  addresses  this  issue  and 
clarifies  policy  to  assure  that  the  second  person  counting  monetary  evidence  must  of  the  rank  of 
sergeant  or  higher.  As  for  the  proper  entering  of  the  amount  into  PETS,  internal  quality  control 
training  has  been  provided  to  PCD  members. 

Finding  1.4,  “The  department  needs  to  improve  its  procedures  for  sealing  monetary 
evidence  envelopes.” 

Current  PCD  policies  and  the  Department  General  Order  (6.15)  were  found  to  be  in  conflict  with 
each  other  during  this  audit.  As  such.  Department  Bulletin  10-115  was  issued  to  clarify  this  issue 
and  to  set  the  standard  of  taping  and  initialing  all  seams  of  the  monetary  evidence  envelope.  This 
practice  is  now  the  same  as  what  the  Department  requires  for  narcotics  evidence  envelopes. 
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Controller's  recommendations  made  in  response  to  Finding  1.4  are: 

7.  Obtain  monetary  evidence  envelopes  specifically  designed  to  maintain  the  integrity  of  the 
money  contained  in  the  envelope.  Such  envelopes  would  only  have  one  opening. 

S.  Issue  updated  guidance  that  requires  current  monetary  evidence  envelopes  to  be  taped 
and  signed  across  all  three  of  the  envelope’s  entry  points,  until  it  implements  the  new 
envelopes. 

SFPD  response: 

We  concur  with  the  recommendations.  Currently,  the  SFPD  requires  two  signatures  and  stamps 
(officer  counting  and  supervisor  verifying)  to  be  placed  on  the  monetary  evidence  envelope.  The 
PCD  is  in  the  process  of  designing  a new  monetary  evidence  envelope  that  will  contain  printed 
signature  blocks.  Based  on  industry  best  practices  the  Department’s  Management  Analysis  and 
Audit  may  make  further  recommendation  to  the  design  of  the  new  envelope. 

Department  Bulletin  10-115  provides  the  updated  guidance  requested  for  the  proper  way  to 
secure  the  monetary  evidence  envelope,  with  tape  and  the  booking  officer’s  initials  on  all  three 
scams. 

Finding  2.1,  “Access  control  to  property  evidence  data  can  be  strengthened.” 

T he  PETS  system  is  clearly  outdated  and  lacks  the  functionality  to  support  accepted  industry  best 
practices.  Current  plans  call  for  the  PETS  system  to  be  replaced  by  a new  records  management 
system.  The  new  system  would  provide  better  security  and  the  functionality  to  create  the  sort  of 
storage  and  destruction  reports  necessary  to  efficiently  manage  PCD. 

As  stated  above,  this  recommendation  will  also  be  considered  as  the  department  evaluates  IT 
solutions  as  part  of  its  currently  ongoing  Management  Analysis  and  Audit  of  its  property 
processing  systems.  DT1S  and  the  IT  unit  of  the  SFPD  will  be  partners  in  our  efforts  to  identify 
and  implement  appropriate  IT  support  at  PCD. 

Controller ’s  recommendations  made  in  response  to  Finding  2. 1 are: 

9.  Consider  adding  user-based  security  access  to  PETS,  which  would  allow  only  current 
PCU  staff  to  have  access  to  modify  PETS  records. 

10.  Produce  a current  list  identifying  the  location  of  all  28  terminals  that  currently  have 
access  to  modify  PETS,  and  consider  whether  any  of  these  28  should  have  their  access 
adjusted. 

SFPD  response: 

We  concur  with  the  recommendations  of  the  Controller’s  office  and  will  collaborate  further  with 
DT1S  and  the  SFPD  IT  unit  to  strengthen  access  to  evidence  data.  DT1S  personnel  advise  that 
user  based  security  access  did  exist  briefly  in  CABLE  (the  CABLE9  monitor),  but  it  was 
removed  when  ICAD  security  came  on  line,  and  staffing  constraints  limit  their  ability  to  recreate 
this  capability.  SFPD  IT  suggests  that  they  may  be  able  to  manage  user  security  in  the  Level  2 
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application.  DTIS  and  the  IT  unit  of  the  SFPD  will  be  our  key  partners  as  we  endeavor  to 
implement  appropriate  IT  security  at  PCD. 

The  draft  atidit  report  states  that  there  are  28  terminals  throughout  the  Department  that  have 
access  to  modify  PETS.  In  fact,  there  are  only  19  active  terminals  that  have  access  to  modify 
PETS.  PCD  has  12  remaining  and  SFPD  IT  personnel  control  the  other  7 terminals.  A list  of  the 
terminals  and  their  locations  is  attached  to  this  report.  No  other  department  computer  terminal 
has  the  access  level  needed  to  modify  PETS. 

Finding  2.2,  “The  PCD  does  not  conduct  routine  reviews  to  ensure  it  has  a current  list  of 
authorized  PETS  users.” 

This  finding  is  correct  and  protocols  are  being  established  with  the  assistance  of  DTIS  and  SFPD 
IT  to  limit  user  access  levels  and  regularly  review  user  access  to  PETS  so  as  to  limit  user  access 
as  appropriate. 

Controller's  recommendation  made  in  response  to  Finding  2.2  is: 

1 1 . Conduct  a periodic  review  of  its  PETS  users  to  ensure  that  current  users*  access  rights  are 
appropriate  based  on  their  job  functions,  terminated  members  are  removed  timely,  and 
that  access  rights  for  new  users  are  approved  by  management. 

SFPD  response: 

We  concur  with  this  finding  and  recommendation.  Property  Control  Division  management  will 
determine  who  should  and  should  not  have  access.  When  that  has  been  determined,  SFPD  IT  will 
modify  user  rights  and  access  to  PETS. 

Finding  3.1,  “The  PCD  does  not  maintain  current  policies  and  procedures  for  handling 
monetary  evidence.” 

PCD  policies  and  procedures  are  in  conflict  with  DGO  6.15  because  the  DGO  has  not  been 
amended  in  many  years.  The  SFPD  has  created  a new  Written  Directives  Unit  that  will  work  to 
address  the  updating  of  the  SFPD’s  General  Orders.  As  for  the  PCD  policies  and  procedures,  a 
Management  Analysis  and  Audit  is  being  conducted  on  the  entire  operation  of  the  PCD.  All 
policies  and  procedures  will  be  reviewed  and  updated  during  this  process.  Policies  and 
procedures  specific  to  the  processing  of  monetary  evidence  will  be  addressed  at  this  time  as  well. 

Controller's  recommendation  in  response  to  Finding  3. 1 is: 

12.  Advise  the  Property  Control  Unit  to  update  its  policies  and  procedures  to  reflect  current 
practices,  as  well  as  to  take  into  account  any  department-issued  orders,  bulletins,  and 
memoranda  that  may  affect  the  PCD’s  practices. 
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SFPD  response: 

Although  there  are  policies  and  procedures  in  place  with  regard  to  handling  monetary  evidence, 
we  concur  that  they  are  not  current  and  could  be  updated.  During  this  time,  a Management 
Analysis  and  Audit  of  all  PCD  policies  and  procedures  is  being  conducted.  Monetary  evidence 
processing  policies  and  procedures  will  soon  be  updated  as  a result  of  both  audits. 

Finding  .1.2,  “The  PCD  conducts  monthly  reviews  of  aged  items  but  does  not  perform 
routine  annual  reviews.” 

Wc  concur  with  this  finding.  The  Management  Analysis  and  Audit  will  also  address  the  policies 
and  procedures  with  regards  to  conducting  annual  reviews  of  monetary  evidence.  Additionally,  a 
monetary  evidence  reduction  plan  will  be  implemented  at  the  conclusion  of  this  audit  in  order  to 
deposit  monetary  evidence  that  is  not  on  hold  after  15  months  and  any  funds  that  have  been 
released  by  inspectors. 

Controller’s  recommendations  in  response  to  Finding  3.2: 

13.  Develop  and  implement  routine  review  procedures  for  monetary  evidence  and  property 
that  has  been  stored  for  greater  than  18-months. 

14.  Revise  its  policies  and  procedures  to  reflect  current  practices  and  implementation  of 
additional,  revised  and  comprehensive  procedures. 

1 5 . Appropriately  process  the  955  aged  envelopes  that  should  by  now  have  received 
disposition  instructions  from  their  case  officers  through  the  monthly  review  process. 

SFPD  response: 

We  concur  with  this  finding  and  recommendations.  Current  policies  and  procedures  are  in  place 
for  the  annual  review  of  monetary  evidence  but  will  be  reviewed  during  the  Management 
Analysis  and  Audit.  However,  a plan  is  ready  to  be  implemented  to  reduce  the  amount  of 
monetary  evidence  held  in  the  PCD  safe. 

Finding  4.1,  “The  department  and  the  PCD  have  inadequate  segregation  of  money 
handling  duties.” 

PCD  management  is  determining  the  job  assignments  for  the  various  personnel  that  handle 
monetary  evidence  on  a daily  basis.  This  issue  has  been  primarily  addressed  with  the  addition  of 
a civilian  clerk  who  checks  written  evidence  records  from  the  stations,  logbook  and  computer 
entries  at  PCD.  Policies  and  procedures  with  regard  to  the  preparation  and  deposit  of  monetary 
evidence  are  being  addressed  during  the  Management  Analysis  and  Audit. 

Controller’s  recommendation  in  response  to  Finding  4.1: 

16.  Develop  and  implement  updated  procedures  and  job  descriptions  that  incorporate  sound 
segregation  of  duties  throughout  PCD’s  monetary  evidence  handling  activities. 
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SFPD  Response: 

We  concur  with  this  finding  and  recommendation.  A review  of  all  policies  and  procedures  of  the 
Property  Control  Division  is  being  conducted  by  a Management  Analysis  and  Audit.  It  is 
anticipated  that  after  evaluating  current  positions  and  mapping  work  processes,  segregating 
duties  to  increase  the  reliability  of  the  system  will  be  accomplished. 

Finding  4.2,  “Additional  training  in  monetary  evidence  handling  needs  to  be  provided.” 

Although  station  personnel  stated  that  they  have  no  additional  written  guidance,  the  monetary' 
evidence  envelopes  contain  written  instructions  on  the  back.  The  booking  of  monetary  evidence 
is  very  much  like  that  of  booking  other  items  of  evidence.  The  monetary  evidence  envelope  is 
different,  with  a green  border;  however,  all  information  required  for  the  envelope  is  located  in 
boxes  on  the  front  of  the  envelope  with  the  instructions  on  the  back.  DB  10-115  has  been 
distributed  and  contains  additional  information  for  the  proper  processing  of  monetary  evidence. 
Moreover,  each  time  that  monetary  evidence  is  booked  a supervisor  also  counts  the  money  and 
certifies  the  accuracy  of  the  count. 

Controller’s  recommendations  in  response  to  Finding  4.2  are: 

17.  Issue  routine  and  comprehensive  guidance  to  all  officers  and  district  stations  regarding 
proper  monetary  evidence  handling  procedures. 

1 8.  Advise  the  PCD  to  work  with  SFPD  IT  and  the  City’s  Department  of  Technology  to 
develop  a user  reference  and  training  manual  for  PETS. 

SFPD  response: 

We  partially  concur  with  these  recommendations.  It  is  not  a very  difficult  task  to  properly  fill  out 
an  evidence  envelope.  SFPD  Department  Bulletin  10-115,  '‘Monetary  Evidence  Processing”,  was 
issued  4/27/2010  and  addresses  this  recommendation.  Also,  a picture  of  the  front  and  back  of  a 
properly  filled  out  monetary  evidence  envelope  will  be  posted  at  each  evidence  storage  location 
at  each  District  station. 

Although  we  are  supposed  to  move  towards  a new  records  management  system  that  includes  a 
new  property  and  evidence  module,  DTIS  recommends  that  the  PCD  assign  a member  to  draft  a 
document  that  explains  how  the  unit  uses  all  the  transactions/screens  in  PETS.  This  document 
will  serve  as  DTIS’s  basis  for  developing  a user  reference  guide  for  PETS. 

Finding  4.3,  “The  PCD  produces  no  routine  management  reports.” 

In  order  to  have  any  reports  produced,  PCD  management  must  make  a request  through  DTIS. 
The  reports  that  are  produced  are  not  easily  interpreted.  PCD  staff  cannot  create  reports 
themselves  for  senior  management.  Newer  technology  may  help  with  the  production  of  reports. 
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Controller’s  recommendation  with  regards  to  Finding  4.3  is: 

19.  Develop  a monthly  or  quarterly  report  through  which  the  PCU  can  provide  department 
management  with  summary  descriptive  information  regarding  the  money  evidence 
inventory. 

SFPD  response: 

Wc  concur  with  this  finding  and  recommendation.  The  Property  Control  Division  management 
will  identify  the  required  content  of  the  report  and  the  SFPD  IT  Unit  will  assist  in  producing  the 
report  as  needed.  With  the  potential  lor  the  implementation  of  a new  property  and  evidence 
module  in  a new  records  management  system,  reports  such  as  these  should  be  easily 
customizable. 
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Respectfullysubmitted, 


enclosures 
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